From c9f663fe76b387163ea213e580299827c7a2aa9a Mon Sep 17 00:00:00 2001
From: Katie Smith <katie.smith@digital.cabinet-office.gov.uk>
Date: Tue, 28 Jul 2020 14:43:31 +0100
Subject: [PATCH] Check for invalid chars in letter addresses when sending
 through the API

This uses the new method in notifications-utils to validate for invalid
characters in address blocks.
---
 app/v2/notifications/post_notifications.py    |  4 ++
 .../test_post_letter_notifications.py         | 56 ++++++++++++-------
 2 files changed, 41 insertions(+), 19 deletions(-)

diff --git a/app/v2/notifications/post_notifications.py b/app/v2/notifications/post_notifications.py
index aa204721a..20bb50269 100644
--- a/app/v2/notifications/post_notifications.py
+++ b/app/v2/notifications/post_notifications.py
@@ -409,6 +409,10 @@ def validate_address(service, letter_data):
         raise ValidationError(
             message='Must be a real UK postcode'
         )
+    if address.has_invalid_characters:
+        raise ValidationError(
+            message='Address lines must not start with any of the following characters: @ ( ) = [ ] ” \\ / ,'
+        )
 
 
 def process_precompiled_letter_notifications(*, letter_data, api_key, service, template, reply_to_text):
diff --git a/tests/app/v2/notifications/test_post_letter_notifications.py b/tests/app/v2/notifications/test_post_letter_notifications.py
index c87afcdc2..e3ea139a2 100644
--- a/tests/app/v2/notifications/test_post_letter_notifications.py
+++ b/tests/app/v2/notifications/test_post_letter_notifications.py
@@ -176,31 +176,49 @@ def test_post_letter_notification_stores_country(
     )
 
 
-@pytest.mark.parametrize('permissions, expected_error', (
+@pytest.mark.parametrize('permissions, personalisation, expected_error', (
     (
         [LETTER_TYPE],
-        'Must be a real UK postcode',
-    ),
-    (
-        [LETTER_TYPE, INTERNATIONAL_LETTERS],
-        'Last line of address must be a real UK postcode or another country',
-    ),
-))
-def test_post_letter_notification_throws_error_for_bad_postcode(
-    client, notify_db_session, mocker, permissions, expected_error
-):
-    service = create_service(service_permissions=[LETTER_TYPE])
-    template = create_template(service, template_type="letter", postage="first")
-    mocker.patch('app.celery.tasks.letters_pdf_tasks.get_pdf_for_templated_letter.apply_async')
-    data = {
-        'template_id': str(template.id),
-        'personalisation': {
+        {
             'address_line_1': 'Her Royal Highness Queen Elizabeth II',
             'address_line_2': 'Buckingham Palace',
             'address_line_3': 'London',
             'postcode': 'not a real postcode',
             'name': 'Lizzie'
-        }
+        },
+        'Must be a real UK postcode',
+    ),
+    (
+        [LETTER_TYPE],
+        {
+            'address_line_1': 'Her Royal Highness Queen Elizabeth II',
+            'address_line_2': ']Buckingham Palace',
+            'postcode': 'SW1A 1AA',
+            'name': 'Lizzie'
+        },
+        'Address lines must not start with any of the following characters: @ ( ) = [ ] ” \\ / ,',
+    ),
+    (
+        [LETTER_TYPE, INTERNATIONAL_LETTERS],
+        {
+            'address_line_1': 'Her Royal Highness Queen Elizabeth II',
+            'address_line_2': 'Buckingham Palace',
+            'address_line_3': 'London',
+            'postcode': 'not a real postcode',
+            'name': 'Lizzie'
+        },
+        'Last line of address must be a real UK postcode or another country',
+    ),
+))
+def test_post_letter_notification_throws_error_for_bad_address(
+    client, notify_db_session, mocker, permissions, personalisation, expected_error
+):
+    service = create_service(service_permissions=permissions)
+    template = create_template(service, template_type="letter", postage="first")
+    mocker.patch('app.celery.tasks.letters_pdf_tasks.get_pdf_for_templated_letter.apply_async')
+    data = {
+        'template_id': str(template.id),
+        'personalisation': personalisation
     }
 
     error_json = letter_request(client, data, service_id=service.id, _expected_status=400)
@@ -208,7 +226,7 @@ def test_post_letter_notification_throws_error_for_bad_postcode(
     assert error_json['status_code'] == 400
     assert error_json['errors'] == [{
         'error': 'ValidationError',
-        'message': 'Must be a real UK postcode'
+        'message': expected_error
     }]